Overview of the UK Age Appropriate Design Code (Children’s Code)
The UK Age Appropriate Design Code, commonly referred to as the Children’s Code, is a statutory framework established under the Data Protection Act 2018. It mandates that online services likely to be accessed by children under 18 must adhere to 15 specific design standards. The Code was developed by the Information Commissioner’s Office (ICO) and came into full enforcement on 2 September 2020, following a one-year grace period. Its implementation aligns with the UK General Data Protection Regulation (GDPR) and the Convention on the Rights of the Child, ensuring compliance is legally enforceable under the Data Protection Act 2018.
The Code applies to any information society service (ISS), including websites, apps, online games, social media platforms, connected toys, and digital news services, where there is a likelihood of child users. This includes services not explicitly targeted at children but accessible to them. The framework was introduced to address concerns over digital exploitation, commercial manipulation, and privacy risks faced by children online, emphasizing that services must prioritize their best interests in design and operation.
Key Principles and Design Standards
The Children’s Code is structured around 15 standards that require online services to adopt a privacy-by-default approach. Central to these standards is the principle that services must be designed with the best interests of children at their core, considering their physical and mental well-being, safety, and privacy. This includes protecting children from commercial or sexual exploitation and acknowledging the role of parents and caregivers in safeguarding their interests.
One of the most critical requirements is the mandatory use of the highest privacy settings by default for child users. Services must minimize data collection to only what is strictly necessary for the service elements a child is actively and knowingly engaged in. Profiling, including behavioral tracking and targeted advertising, is restricted unless justified by compelling reasons aligned with the child’s best interests. Location tracking and access to data by other users are also prohibited unless necessary and justified.
The Code further mandates that privacy policies, settings, and tools must be presented in clear, accessible language tailored to the age group using the service. Dark patterns—deceptive design techniques used to manipulate users into reducing their privacy—are explicitly prohibited. Additionally, services must ensure that children under 13 cannot provide verifiable consent for data processing; instead, consent must be given by a parent or custodian, in line with GDPR requirements.
Implementation and Compliance Requirements
Organizations of all sizes and sectors, including small businesses, are required to comply with the Children’s Code if their services are likely to be accessed by children. The ICO provides comprehensive guidance, including risk assessment templates and case studies, to help businesses understand their obligations. For example, the ICO offers sector-specific guidance for edtech providers, digital news services, and game designers, outlining practical steps to ensure compliance.
The ICO provides general DPIA templates and examples tailored to specific industries, such as online retail, connected toys, and mobile games. These assessments help organizations adopt a proportionate and risk-based approach to protecting children’s privacy and ensuring adherence to the Code’s standards.
The ICO has also collaborated internationally to establish shared principles for age assurance through a joint statement with other regulators. This initiative aims to create a common framework for verifying user ages and delivering age-appropriate experiences across jurisdictions. Real-world examples and case studies shared by organizations illustrate different approaches to age assurance and compliance, providing practical insights for businesses.
For instance, Instagram automatically sets accounts created by users under 18 to private by default, restricting direct messaging from non-followers. TikTok has committed to limiting push notifications to children during evening and nighttime hours, while YouTube applies stricter privacy settings to content designated as ‘made for kids,’ disabling autoplay, personalization, and targeted advertising.
Enforcement and International Influence
The Children’s Code is enforceable under the Data Protection Act 2018, meaning non-compliance can result in regulatory action by the ICO. California adopted a similar framework through AB 2273, the California Age-Appropriate Design Code Act, in 2022. However, this legislation was later ruled unconstitutional in September 2023 by a federal judge on First Amendment grounds, highlighting the challenges of balancing regulatory intent with constitutional protections in other jurisdictions.
Despite the setback in California, the UK’s Children’s Code remains a model for other regions seeking to enhance digital safety and privacy for children. The Code’s emphasis on transparency, data minimization, and child-centric design continues to serve as a benchmark for global efforts to mitigate online harms affecting young users.
Required actions
- Apply the 15 standards to services likely to be accessed by children: high-privacy defaults, no profiling by default, no nudge techniques, DPIAs - Explain algorithmic recommendations and personalisation in ways children can understand